DC Museum Cyber Insurance: Protecting Donors and Digital Collections

Every museum in the District runs on two kinds of collections. There is the one the public sees — the paintings, the artifacts, the rotating exhibits. And there is the one nobody sees: the donor database, the membership roster, the ticketing system, the terabytes of digitized archives sitting on a server in the basement. When board members ask me about DC museum cyber insurance, they are almost always thinking about that second collection, and they are right to.

I have sat in enough Washington nonprofit board meetings to know how the conversation usually goes. Someone asks whether the museum's general liability policy "covers computers." The answer is more complicated than anyone wants it to be, and the time to work through it is before an incident, not during one.

Why donor data raises the stakes in the District

A donor file is not just contact information. It often pairs names with financial account numbers, giving histories, and sometimes payment card details. Membership and ticketing systems add more. Digitized collections carry their own exposure — years of scanning work that can be encrypted and held hostage by ransomware.

The District has a specific legal framework here. The D.C. Office of the Attorney General explains the requirements of the District's data breach notification law, built on the Consumer Security Breach Notification Act as updated by the Security Breach Protection Amendment Act. A breach is defined as the unauthorized acquisition of electronic personal information. Organizations must notify affected consumers and the OAG in the most expedient time possible, without unreasonable delay. Personal information under the law can include a name combined with a Social Security number, a driver's license or D.C. identification number, financial account numbers, medical information, biometric data, and related identifiers.

Worth saying plainly: breach notification law is not insurance coverage. The law tells you what you owe the public. It says nothing about who pays for the forensics, the notification mailing, or the credit monitoring. Those are separate questions, and they belong on the same agenda.

Questions to bring to your next board review

• Which systems actually hold personal information — and who has administrative access to them?
• Are digitized collections backed up somewhere ransomware cannot reach?
• Does your current insurance program contemplate a cyber event at all, or are you assuming it does?
• Who makes the first call if something happens on a Friday night before a gala?
• If a vendor handling your ticketing is breached, what does your contract say about responsibility?

A free insurance review, not a sales pitch

D.H. Lloyd has worked with Washington institutions long enough to know that no two museums carry the same risk. We offer a free insurance review — a walk through what you have, what you assume you have, and where the gaps sit. No price quote, no obligation.

Call 202-223-1506, email contactus@dhlloyd.com, or stop by 1625 K St NW. You can also learn more at D.H. Lloyd.

This article is educational and general in nature. It is not legal advice, not a substitute for counsel, and not a statement of coverage. Policy terms, conditions, and exclusions govern all coverage questions.